Permissions mapping

Windows® ACL is a complex structure that defines the owner, group, and access attributes of any resource of a Windows® system, for example a file. Microsoft describes Windows® ACL under Access Control Lists.

The structure is a list of ACEs (Access Control Entries). An ACE defines the trustee that it applies to and an access mask that specifies the rights. The Windows Client supports only the allow type of ACE.

POSIX to Windows® ACL

When the Windows Client converts POSIX permissions to an ACL, it checks the permissions and returns three elements:

• Owner (Windows® SID if UID mapping is set in LDAP, or the special SDDL_CREATOR_OWNER object)
• Group (Group SID or SDDL_CREATOR_GROUP)
• Everyone (SDDL_EVERYONE)

These ACE access masks can be retrieved for each element:

• FA – FILE_ALL_ACCESS
• FR – FILE_GENERIC_READ
• FW – FILE_GENERIC_WRITE
• FX – FILE_GENERIC_EXECUTE

Windows® ACL to POSIX

Windows® ACL does not map directly to POSIX. A sophisticated Windows® ACL mechanism cannot be translated into a simple POSIX permission system. When you change the permissions for a file from Windows®, all permissions other than write, read, and execute are ignored. An ACL that holds any other permission therefore comes back from the cluster different from the ACL that you set.

Read is set when FILE_READ_DATA or FILE_READ_ATTRIBUTES or FILE_READ_EA or GENERIC_ALL or GENERIC_READ is set.

Write is set when FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES or FILE_WRITE_EA or FILE_APPEND_DATA or GENERIC_ALL or GENERIC_WRITE is set.

Execute is set when FILE_EXECUTE or GENERIC_ALL or GENERIC_EXECUTE is set.

However, an attempt to set permissions of a type other than ALLOW returns an error. Adding an entry for a user or group other than the file owner, the file group, or the special identity ALL also returns an error.

Additionally, the owner's permissions are combined with permissions of all. Similarly, the group permissions are combined with those from the EVERYONE object.